Initial commit

.env.example

@@ -0,0 +1,54 @@
+# Copy this file to .env in the Unraid deployment directory
+# (/mnt/tank/appdata/notizarr/.env) and fill in real values.
+# Never commit a real .env.
+
+# ---- Identity / URLs ----
+PUBLIC_BASE_URL=https://notizarr.example.com
+PORT_WEB=8080
+PORT_INGEST=8081
+
+# Host bind addresses used by docker/docker-compose.prod.yml.
+# BIND_ADDR_INGEST defaults to 127.0.0.1 on purpose (see docs/phase1/02-threat-model.md) -
+# set it to your LAN interface IP (e.g. 192.168.1.10) so LAN devices can publish,
+# but never set it to 0.0.0.0 on a host with any WAN exposure.
+BIND_ADDR_WEB=0.0.0.0
+BIND_ADDR_INGEST=127.0.0.1
+
+# ---- Auth ----
+# oidc | proxy | disabled
+AUTH_MODE=oidc
+OIDC_ISSUER_URL=
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+OIDC_REDIRECT_URL=https://notizarr.example.com/api/v1/auth/oidc/callback
+OIDC_SCOPES=openid profile email
+
+AUTH_PROXY_USER_HEADER=
+AUTH_PROXY_EMAIL_HEADER=
+AUTH_PROXY_GROUPS_HEADER=
+TRUSTED_PROXY_CIDRS=
+
+# ---- Database ----
+POSTGRES_USER=notizarr
+POSTGRES_PASSWORD=change-me
+POSTGRES_DB=notizarr
+
+# ---- Push ----
+VAPID_SUBJECT=mailto:admin@example.com
+
+# ---- Ingestion safety ----
+# Comma-separated CIDRs allowed to hit the :8081 ingestion listener,
+# enforced in-app as defense in depth beyond network-level firewalling.
+INGESTION_ALLOWED_CIDRS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+
+# ---- Retention / rate limiting defaults (editable later in Admin > Settings) ----
+RETENTION_DEFAULT_DAYS=90
+RATE_LIMIT_SUSTAINED_PER_MIN=60
+RATE_LIMIT_BURST_PER_10S=20
+
+# ---- Ops ----
+LOG_LEVEL=info
+DOCS_ENABLED=true
+
+# Image tag to run, if not building in place
+NOTIZARR_IMAGE=notizarr:latest